diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index 817114cb452c..587cf10f9c53 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -327,6 +327,7 @@ in
           "@system-service"
           "~@privileged @obsolete"
           "@pkey"
+          "fchown" # needed for filesystem image backend
         ];
         UMask = "0007";
       };